Archive for the ‘General’ Category

Recap of 2023

Friday, December 29th, 2023

Hi all, I want to take the opportunity to look back at the year 2023, and discuss our achievements of the last year. The first post on Blackbag of the year was on a modified electric heater. While the post was off brand (as in: not a lock), it helped several pickers to save hundreds of euros on the heating bill. I’ve used mine ever since.

Our first event of the year was in February, a luxurious hacking experience at Hackerhotel. It was a good conference where we talked with our friends from other Dutch Hackerspaces. The talks were everything from community discussions to creativity and security topics. Toool hosted three impressioning workshops a day, and Jan-Willem gave a talk on experimental lockpicking techniques. Which includes, analysis of the Bowley Rotasera, and lessons learned on the Kromer protector.

Wendt hosted a well received lockpicking competition end of March. Walter and Henri competed, and several others joined for the exposition and side events. In case you have missed it, Wendt invites you to join their open house 2nd and 3rd of March 2024.

In May Toool was at the last HITBSecConf2023 in Amsterdam. Toool has hosted the lockpicking village for HITB Amsterdam from the beginning of the conference, and we made great friends along the way. It is truly an end of a decade. The lockpicking village has always been one of the more consistent and popular side events at the conference, and we hosted it again with great pleasure.

During the summer, several Toool members from the Netherlands went to Defcon and visited the lockpicking village hosted by Toool US and to promote Locksport. I, myself, went to the Chaos Communication Camp in Germany. This is the largest German hacker camp hosted by the Choas Computer Club. Jascha from Sportsfreunden der Sperrtechnik, SSDeV set up the lockpicking event, which was a great success. I’ve run a few sessions in English, it was good fun.

LockCon was in October hosted at the Westcord Hotel in Garderen. We hosted close to a hundred guests from all over the world. Where in the three days we ran four competitions, a dozen talks, and many locks picked. It was great to meet our friends again. The recap of the event is worth a read.

ACF organized their annual festival in December. Walter traveled to Paris for the event and competition and won the third price. Walter shares his thoughts in this post.

Next to all these big events, we went twice at Tkkrlab, Hack42, and several other small events. On average we have run a side event a month. Furthermore, we hosted a lockpicking meetup almost every week, as well as published several blogs on locks, tools, and more, here on Blackbag. In case you have missed them, here are the highlights.

Walter looks for interesting locks and published a series of small unusual locks. For example, Walter found a 28mm double euro cylinder from Keso which is unique as it is operated with a standard length key. This short 6-pin euro cylinder from Dom is also quite clever. The Evva Elus is also a curiosity. Given the lock has electromechanical master keying.

I’ve written quite a bit for blackbag, for example on the cutaway collection from Qikom. Furthermore, in a collaborative work, I’ve 3D printed keys for the Abloy Protec2, as well as analyzed the yet unpicked Dulimex PRO-LINE padlock.

Henri wrote about a clever implementation of multi tenant lever locks. These and other lever locks are quite rare here, sadly. It’s a wonderful, but forgotten technology, which still has a place in high security systems in the UK and Italy. Hopefully, Henri will write more about those in a future Blackbag post.

To end this list, we like to suggest reading a post with in depth technical knowledge. The report in the LockCon 2022 impressioning competition. The document can be quite useful for pickers interested in impressioning.

If you see something you like, please leave a reaction below the post. It’ll help grow the brand as well as motivate the writers to continue putting in the effort. If you want to share your project on Blackbag, do reach out as well.

Best holiday wishes from me and the rest of Toool,
May many locks open for you in 2024 🙂

Jan-Willem Markus
Secretary of The Open Organisation of Lockpickers

Progressive Disc detainer

Sunday, December 17th, 2023

In learning lockpicking try to get all advantage you can get. A good first step is to learn as much as possible about the lock. For example, You should disassemble and reassemble the lock a few times, but looking at pictures on the lpubelts or lockwiki are good options as well. The next step is to assemble the lock with fewer locking elements, pick it, and increase the difficulty after each success. This is a well understood practicing method for pin tumbler locks, call progressive pinning.

I’ve built several progressive locks for myself and for teaching lockpicking to others. Of some locks, I’ve got a keyed alike set. In this way, you can practice the locks without the (sometimes tedious) opening and reassembly of the locks. For the practice session, just work through the locks in the set.

For disc detainer locks we aren’t lucky as the locks don’t function well without all the elements. The locks consist of a stack of code discs and spacers and all live in a partially cut hollow tube. If you have several of the same lock, you can use the spacers from one lock to fill the progressive lock. This technique worked well for an attempt to pick the Rosengrens 32A81 lock.

Disassembled Rosengrens 32A81 Safe deposit box lock.

Dmac shows an clever alternative for regular disc detainers in this video. He is replacing part of the disc stack with a properly sized tube to take up the space of the missing discs. The tube allows the key to operate the lock and has enough movement to move freely and not impede the sidebar, but small enough so the sidebar doesn’t drop in the core. This is a clever trick which is certainly worth testing.

In this post, I propose an alternative solution which is more generic, and will most likely work for all disc detainer, lever, and wafer locks. I’ve designed a spacer to fill the lock. The spacer shape can often be reproduced from the original lock parts in most CAD packages within hours. As a proof of concept, I’ve designed the spacers for the Anchor Las and laser cut the parts at Hackerspace Bitlair in Amstersfoort.

My process is quite straight forward: Measure the part, design it in OpenCAD, determine the laser parameters, cut the part, test the part. Then adjust and repeat the steps until satisfied with the results. (Or when you run out of material/time/money, whatever comes first.) It is like CI/CD, but in hardware, with an iteration cycle of about five minutes.

In the table below, I’ve captured the measurements of the core from the Anchor Las 833-3 padlock.

Disc pack20.51 mm
Disc1.395 mm
Spacer0.5 mm (calculated)
Core13.92 mm
Sidebar1.97 mm
Key width5.1mm
Spacers stack0.5 mm + 0.28 mm
Anchor Las measurements with a micrometer.

Getting the dimensions into OpenSCAD isn’t too difficult. I did however reuse someone else’s code for a partial circle, which isn’t trivial in this scripting language. (The code will be on the bottom of the page)

Laser cutters are amazing machines, and I’m always excited when finding a new use for the tool. My go-to materials are acrylic, Delrin, and the occasional sheets of triplex. While, acrylic isn’t the most robust, it makes for great visualizations. POM (Delrin and Acetal are the brandnames) is an engineering plastic great for key gauges and other locksport tools. It also so happens to work great for lock replacement parts.

To get the part the correct size, we need to compensate for the kerf (laser cut width). While it can be measured, I chose to do trial and error: change the kerf compensation in the Lightburn laser software and measure the parts with a micrometer. After I was satisfied, I ran a small batch of a hundred rings, just so there are enough to play with for me and other community members.

At the hackerspace, we actively share lessons learned. For this one, I’ve found putting a sacrificial material below the Delrin greatly improved the cut quality. Half the power and speed, with two passes also worked well. The laser parameters are saved to the Bitlair wiki for others to use in the future.

Back home, I’ve assembled the lock with the spacers and found them to be slightly too large. The sandpaper took off the difference quite easily. After reassembly, the lock works great with the key and it’s hard to distinguish from a lock with a complete disc pack. (I see options for a trick lock).

I’m looking forward to picking it, and will have others play with the lock as well to gather feedback on how the parts affects picking. As I expect the Delrin spacer have noticeably more friction than metal on metal, it will likely be beneficial to keep code discs in between original spacers. Furthermore, the lock works fine without a shackle and won’t brick on you without one.

Above are the minimum parts required for a functional front tensioning training lock.

I’ve picked the lock a few times with six random code discs. This is nine spacers of 1mm thick, and six of each code disc and metal spacer. After which, I quickly progressed through the other configuration, and picked the unmodified lock an hour later. As the spacers are thinner than discs, I’ve used the remaining metal spacers to fill out the remaining space.

At the moment we do not have a repository of lock parts, but we will likely create one soon.
In the meantime, the script for OpenSCAD is attached below. When you create your own discs, please share them around.

// Ancher Las spacer V2.1
// 20231213 Jan-Willem CCBY4.0
// OpenSCAD 2021

// F5 render
// F6 generate
// Export as ...

$fn = 100;

projection() // make it flat
difference(){ // substract the keyhole and gate from the disc
    union(){ // create the disc
        cylinder(1.4,11.4/2,11.4/2, center = true);

        // code for a part of a circle
        radius = 13.2/2;
        angles = [35, 145];

        linear_extrude(1.4, center = true){
        points = [
            for(a = [angles[0]:1:angles[1]]) [radius * cos(a), radius * sin(a)]
            polygon(concat([[0, 0]], points));

    //key hole
    cylinder(1.4,7/2,7/2,, center = true);
    // gate
    cylinder(1.4,3/2,3/2, center = true);

Copyright CCBY4.0 Jan-Willem Markus, Toool NL

Dutch Open 2023 Disc detainer picking results

Monday, October 23rd, 2023

The Dutch Open 2023 Disc Detainer competition was held in a self-timed format. Throughout LockCon, the participants worked on getting the best times on the five Disc detainer locks: 001 Fort Knox, 002 Parkside, 003 No-name, 004 Abus Plus, 005 Abus Plus with butterfly disks.

We used the Sparrows Disc detainer pick with a 3D printed spacer. One of the Sparrows tools was modified to allow tensioning lock 004, the Abus 37/55.

Nitiflor won the competition by opening all the locks and won a Sparrows Vorax set. ImSchatten360 opened all locks as well, but spend more time in total and won the second price, a Sparrows Tuxedo royale. Matt Smith opened four out of five and won for the third price, a Sparrows Tuxedo set.

3D printing keys for Protec2

Saturday, September 23rd, 2023

This story is based on the work from Reinder Stegen, in which the Protec2 was reverse engineered and scripts for parametric key generation are written. Reinder worked with James Wah for the parametric webblification. As in, a free to use online webgenerator for all your Protec2 key needs. To get the keys to the real world, one just needs a good 3D printer.

3D printing keys has been around for at least a decade, from 3D printing scrips like AutoKey3D by Christian Holler to printing many high security keys. Modeling and printing keys gives unique understanding of the underlying principles of the locking mechanisms. I, myself, wouldn’t have understood Kromer protector, Bowley Rorasera, and Fichet F3D as well without modeling the keys.

While 3D printing keys can be a strong attack, the bitting of the key needs to become known to an attacker beforehand. If this attack is within your threat model, please invest into key control. I.e. to keep track of the locks and keys in your system.

The challenge

A set of nine Abloy PL340 locks caught my attention as it was sold as a lockpicking challenge. As in, the seller didn’t have the correct keys, but included keys from the same series. Where the challenge is to open the locks. I chose to work with Reinder to decode one, and 3D print the keys for the rest of the set.

The PL340 are beefy padlocks of around 55*50*25mm, very much excess for any normal consumer applications. While we like them for securing Peli cases, they’ll work fine on your motorcycle or shipping container as well.

The key making process started by decoding the several non-working keys in the package keys. While five cuts were shared between the keys, it wasn’t enough to determine what the keys should be. One lock was disassembled and the disks were decoded according to the pictures in the Protec2 white paper by Han Fey. (Reinder has published a better chart on 22nd of September 2023)

The Protec2 has eleven disks, of which the fourth and eleven are zero disks. All code disks have two true gates, except for a six with one true gate. We see four disks with more than two true gates, which means they are mastered and accept a key with either cuts on it.

I’ve opted to use Python to create a list of all possible keys in this system instead of using pen and paper. After I had a working solution with many nested loops, I found the function product in the itertools package to generate a list of solutions in fewer lines of code. The code below generates and prints the valid keys from a list of lists with possible bittings.

# Quick script to get all possible keys from a single master keyed lock.
# 20230730 Jan-Willem CCBY4.0 Toool NL

import itertools

# The key codes is a list of list of ascii characters. 
key_code = [['0'],['5'],['4'],['6'],['3','5'],['1','6'],['1','3'],['0'],['5','6'],['6'],['1']]
keys = list(itertools.product(*key_code))

for key in keys:

This script should work for most key systems. For me, it generated the sixteen valid keys of this master keyed system. With Reinder’s online generator, I’ve generated the files. As I lack a printer capable of printing these, I used the 3D printing service from JLCPCB. Reinder had good experience with Imagine Black, so that was my starting point as well.

Reinder’s tool for generating the keys isn’t widely shared, yet. He has shared a video in which several more 3D printed keys are showcased, including a few which work better than the online generated keys. Several other scripts (By NVX, and bgrydon) are available online, but they don’t work as well as this work.

Uploading the models it to the service was quite tedious. Not only does the material, finish, and customs description need to be filled in for each print, QA was quite picky, and rejected the files several times. After some touch ups in Meshmixer, the keys are ordered. 3D printing keys was very affordable.

The prints came in after a couple of weeks and look great. As the print doesn’t have a captive ball bearing, I’ve removed one from a non-functioning key. Sadly, none of the keys worked of the first print run. After double-checking the data, I’ve found a translation mistake. One disk was flipped in the picture, where a disk five becomes a three.

After going through the process a second time, the keys opened the lock I decoded. Possibly a bit more surprising, two keys worked on all other locks as well. So these are the master keys of a system bigger than these nine locks.

While it’s a great success, and defeating this system with 3D printing, I think we can do much more with this locking system. I’ll likely revisit the work of Matt Smith, to attempt to pick it, or at least try to find a better way of decoding the locks.

To settle one curiosity, I’ve commissioned new prints generated by Reinder in several materials. These have a captive ball. From left to right, we have: Imagine black, 9000R Resin, 8228 Resin, 8001 Resin, 3201PA-F Nylon, 316L Stainless.

All the plastic keys were dimensionally correct and opened the lock. Of course, the engineering resins work much smoother and are generally stronger. The 8228 seems to be very good, except for the ugly color 🙂

So, what about the metal key? While it is amazing we can have these parts fabricated for €8 per key, the dimensions aren’t there yet. The key is slightly oversized and doesn’t fit the keyway. Of course, you can order keys with several different scaling factors, but it’ll be expensive, whereas the resin prints work well and are relatively cheap. In the end the resin keys are around €2 each, and I’ve spent about €200 on the whole project.

While it’s exciting to ‘defeat’ Protec2 locks with this attack, it’s more a showcase of skill and dedication of people in the locksport community. Thanks, Reinder and James, for allowing me to use this work.

This text and the pictures are CCBY4.0 Jan-Willem Markus, Toool Blackbag.
The copyright of the key generator is with Reinder Stegen and James Wah.

Cutaways, and lever locks

Monday, September 11th, 2023

When we teach lockpicking we usually revert to schematics of locks, and different models for demonstrating the functionality of locks. Usually required as the core functionality is well hidden, and not often observable in action. Multiple skilled machinists have made cutaway locks for the purpose of demonstrating the inner workings of real locks.

At one cutaway themed evening, we had over 50 unique cutaways on the table. From all brands and mechanisms. Some of which even the pins themselves were cutaway.

On an evening with impressioning, a member asked for some blanks to practice with. The call was answered by the keys below. Sadly, it’ll be very hard to find a corresponding lock for the key blanks, as in Europe we have thousands of unique keyways. Even though they all look a-like.

On another evening, we delved deep in lever locks, from your classic Chubb locks to high-end safes. A boroscope was brought as to try to decode some locks by belly reading the levers. E.g. to observe the scratches on the levers and determining the length of the butting making the scratches.

The WE30C also made its appearance, one night. The lock was used on pay phones, and is remarkably hard to lockpick due to the lever blocking system, shown in the top right. As torque is applied, the blocking system engages with the levers, making all levers bind up before the lever tests the gate.

Lips shared access

Wednesday, July 5th, 2023

Locks don’t have to be hard to pick to be interesting, and a Lips lock Jos loaned me is a fine example of that.

Lately I’ve been drawn to picking lever locks, as they have that nice “Skyrim” vibe. You can get a long way with just some bent wires. Knowing that, Jos brought this nice Lips lock to a Toool meetup, and I got to play with it a little.

Picking it is pretty straightforward, as there are no false gates on the lever, and no curtain. The pin in the keyway does make navigation a bit awkward, but all in all it’s not hard to pick. 

Things get more interesting when you take a closer look at the lock.

First of all, it’s a Lips lock. Lips is a Dutch lock manufacturer that was founded in Dordrecht in 1871 by Jacobus Lips. In 1971 it became part of Chubb, and since 2000 it’s part of the Assa Abloy group.

The second name on the lock is P.G.E.M. The P.G.E.M. (or Provinciale Gelderse Energie Maatschappij) was a utility company delivering electricity and gas to the whole province of Gelderland in The Netherlands. Every Dutch province used to have its own utility company. It was owned by the province, and the local municipalities.

In the 1990’s the Dutch government decided all the utility companies had to be privatized, and P.G.E.M. became part of Nuon (which is now a part of Vattenfall).

Below P.G.E.M. are the letters LS, that stand for Laagspanning or Low Voltage. PGEM used these locks to secure electrical substations, and LS indicates this particular lock was used on a low voltage substation. The other side of the lock tells us more about this.

Here we see “Onderstation Woudhuis” written in pencil. Onderstation Woudhuis is a substation located in the city of Apeldoorn.

The double keyway is a striking feature which reminds of dual custody locks, only this isn’t that. It’s shared access, where only one of both keys is required to open the lock. This becomes clear when the faceplate is removed.

This seems to be a form of master keying without having to need to add extra gates to the levers, which would compromise the security of the lock. 

Every lever has two cuts at the bottom. A closer look at two of the levers shows how different cut heights make it possible to open the lock with two different keys.

Moral of the story: locks are fun in so many ways.


After posting the original blog, a good friend in the UK shared a page with the patent of the ‘Mastership’ two keyhole lock from 1889.

What happens at a Toool meetup?

Wednesday, May 31st, 2023

In the current Tool rhythm, we have one meetup a week. Both the Amsterdam and Eindhoven meetups are Bi-weekly, where we planned to have one meetup a week. We come together to discuss lock topics, compete in the Toool competition, and generally have fun picking locks.

In this post, I’d like to share pictures topics and projects that have come across at Toool meetups.

A locked coin safe was brought to the meeting. Due to the construction of the box, the lock was a very difficult to put torque on with a turning tool. We succeeded in opening the lock several times, and had great fun picking the lock in literally seconds with an electronic pick.

Once in a while, we receive donations from community members. This Sparrows vault was donated to us with the request for an upgrade to the lock, as the original served not enough of a challenge. We complied, and mounted a Kaba Mas X0 Electronic lock on the Vault.

Everyone has a go-to pickset, one which is a mix of everything. We also bring Sunday’s best to dedicated sets. For example, Moki makes great picksets, which are even better with homemade handles. Or a shiny Multipick set, be it dimple or a dual-gauge set designed by Christina Palmer. Where the only part staged about the photo is to have all the sets neatly displayed.

We went to the Association des Crocheteurs de France conference in December 2022, and brought back a few tools and picks from France. We attempted to pick the Polox-5, and Fichet F3D. Both attempts made possible by the incredible work of Nitiflor, who designed and 3D printed these picks.

Jos brought a suitcase with Chinese locks, which was gifted to him for organizing LockCon 2016. At the time, these locks were unobtainable, and information sparse. The mechanisms are very intricate with 50-element wafer locks, and cores with continuous rotation similar to the Yuema 750, an implementation we have yet to see used in Europe.

If this blog sparked interest in lockpicking, or if you have been picking and would like to join a meetup, please contact us. We are always welcome to new people, be it to teach the basics or to share advanced tricks.

Cutaway locks, why put in the effort?

Sunday, April 16th, 2023

In a previous blog post, I’ve written about Qikom’s cutaways. Whereas, this post is a tangent on why we would like to see more cutaways made and the knowledge shared.

When we teach beginners, and show them a unique lock, often they can’t imagine what happens in the lock. As all they can see is the outside. To illustrate this, let’s play a short game with a Fichet 787. The key looks quite interesting, as it has half a dozen cutouts on each side. It’s not symmetrical, and can only be inserted in the keyway in one direction. You feel a spring pushing against the key, but at rotation it seems to be like any other lock.

If you haven’t seen this lock before, take a moment to imagine what the internals are like.

Fichet 787. CC-BY-4.0 Jan-Willem, Toool Blackbag

It’s quite obvious where I’m going with this. There can be almost anything inside the shiny cylinder. It will be very difficult to find the solution without taking it a part, or looking at a diagram. The cutaway, like the one from Qikom below, shows the internals from the lock. Reducing the guess work over a picture of the parts.

Qikom Fichet 787 Cutaway
Qikom Fichet 787 Cutaway; The interaction between the lever pack and the gears.
Qikom Fichet 787 Cutaway; The lock is open.

Is it anything like you imagined it to be?

What does the 787 do? The Fichet 787, is a push lever lock. Where the push action allows the lateral movement of the levers to rotate a set of gears to the opening position. The sidebar is a passive element that checks if the gears are all aligned. With the correct key, the cylinder moves inwards, clears a blocking element, and is able to rotate. At the same time, the key is trapped by two half circle disks.

It is quite possible you have seen this lock before, as it has been around for decades. I’ve learned about the lock in 2018, and recently expanded the knowledge at the Association des Crocheteurs de France lock conference in December 2022. I’ve learned the dovetail, which connects the cam to the core, is a fairly recent addition that prevents a (partially) destructive attack, for example.

French locks are my favorite weird lock designs, where Fichet is king. The ingenuity is admirable, with many clever ways to solve the same problem…

Gorgeous cutaway photos from Qikom

Wednesday, January 25th, 2023

Qikom, lockpicker from France, created gorgeous locks cutaways and shared the images online. I believe cutaways to be very useful for understanding intricate lock designs. Where a good cutaway allows us to observe the elements of the lock while still functioning as normal.

Qikom is an associate professor in mathematics and computer science. Who got interesting in lock picking a little before 2000 after reading R. Feynman (the physicist) autobiography. Like many pickers, he is interested in the “puzzle” aspect of locks, and making a working cutaway is another kind of puzzle. Furthermore, he added, to spend more time making cutaways than picking locks!

You can find Qikom’s complete cutaway collection at: The pictures are licensed under CC BY-NC-SA 4.0.

Screenshot from Qikom’s website as of January 2023. CC BY-NC-SA 4.0

I’ve asked Qikom for tips on making great cutaways. He says about his cutaway strategy:

“I don’t have a well-defined strategy when planning a new cutaway. I know people start by making a 3D model of the lock to plan the cuts, but I don’t bother. In many of the locks I’ve cut, the cutting plan isn’t all that complex, and I try to set things up, so I can adjust things incrementally. One important thing I do, is to never cut a lock on the same day that I come up with the cutting plan, to get some time to think about it.

I usually try to have at least 2 identical locks to cut, and I consider one of them to be expendable. When everything works, I can sell / trade the second one, and if not, I get to correct any mistake on the second try. A couple of times, I badly failed twice, but could salvage enough parts to get the third attempt.
But there are still some locks waiting because I wouldn’t want to mess them up.

I’ve made several embarrassing goofs along the way, but none of them would have been prevented by that! The graveyard includes several Robur, Rosengrens, Abloy, Fontaine, and Fichet… 🪦 I’ve only attempted cutting an F3D when I got a couple of broken ones. This was a good idea, because the first 3 attempts were failures.

But there are still some locks waiting because I wouldn’t want to mess them up. Including the Emhart.”

Qikom often sells his cutaways online to partially fund the hobby. If you have interesting in these locks, or have a few spares that would work as a cutaway, consider contacting Qikom at

Wooden lock; Binding order demo

Sunday, May 23rd, 2021

In 2019 Jan-Willem build a binding order demo out of laser cut wood.
In this post we would like to share the project with the rest of the world.

Binding order is the order in which the pins bind in a lock. This is mostly due to the manufacturing tolerances but can have other causes. This concept is hard to grasp for a new lockpicker and is one of those ‘You’ll get it when you see it’ concepts. When teaching lockpicking it is common to hear: ‘I have been pushing down this pin and it doesn’t want to stay down.’ This tool can be used to demonstrate why the pin did not want to stay put.

This demo is certainly not ‘the’ solution. It is just a fair attempt that works for us. It will make the explanation better by adding both the visual and touch to the explanation. The participants can play with the board and feel the effect of binding and what the effect is of using light or strong tension.

For reference: The board is about the size of an A4 piece of paper. The base is crafted from three layers of 3mm plywood. The core is a single sheet and the pins are three or four layers, depending on the feel you prefer. Each pinhole in the base/core has a different size and different offset. All of the pins are a different size er well. This gives plenty of options to change the binding order.

We used the demo in lockpicking villages across the globe. We have found that it helps the explanation immensely when encountering language barriers. Video link to how you can use the binding order demo:

The binding order in this model can be quite subtle. It would great to have another with extreme exaggerated binding order also a smaller, 3D printed version, would be great to have. A bit of paint will not hurt either.

CC-BY-4.0 Jan-Willem Markus Toool Blackbag.